From b790ca312a6609737bdda8bc9142678602a8b5d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89mile=20R=C3=A9?= <emile@getprobo.com>
Date: Thu, 8 Jan 2026 20:05:26 +0100
Subject: [PATCH] Expire invitations on SCIM delete
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Émile Ré <emile@getprobo.com>
---
 pkg/iam/scim/service.go | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkg/iam/scim/service.go b/pkg/iam/scim/service.go
index 0a5973d08..081a26abc 100644
--- a/pkg/iam/scim/service.go
+++ b/pkg/iam/scim/service.go
@@ -471,6 +471,24 @@ func (s *Service) DeleteUser(
 				return fmt.Errorf("cannot delete membership: %w", err)
 			}
 
+			// Expire all pending invitations for email in organization
+			identity := &coredata.Identity{}
+			if err := identity.LoadByID(ctx, tx, membership.IdentityID); err != nil {
+				return fmt.Errorf("cannot load identity: %w", err)
+			}
+			invitations := &coredata.Invitations{}
+			onlyPending := coredata.NewInvitationFilter([]coredata.InvitationStatus{coredata.InvitationStatusPending})
+			if err := invitations.ExpireByEmailAndOrganization(
+				ctx,
+				tx,
+				coredata.NewScopeFromObjectID(config.OrganizationID),
+				identity.EmailAddress,
+				config.OrganizationID,
+				onlyPending,
+			); err != nil {
+				return fmt.Errorf("cannot expire pending invitations: %w", err)
+			}
+
 			return nil
 		},
 	)